MFT / NTLDR / NTFS (external drive) damaged after ntfsresize (Linux)

I have had an external USB drive attached to a RaspberryPi (headless), 1.5 TB Volume, 100% partition NTFS.

During this question Creating ext4 partition from console, my goal was to change the overall fs to ext4 by shrinking the ntfs partition to 50%, copy all files to the new partition and resize the new ext4 to 100% partition.

After using ntfsresize (I first ran a simulation by -n which was fine and then forced the write action which ran without errors too), several errors occured on the partitions filesystem, (again, ntfsresize ran without errors, but the filesystem got damaged).

After shrinking the ntfs to approx. 600 GB, I used fdisk to remove the 100% partition and split it into two 50% partitions, using the correct partition type (I do not boot from this external harddrive, only store data) - which also did not show any errors.

At this point I noticed several errors and were not able to mount the drive anymore.

---

I really need the data which I cannot access anymore and willing to donate the one or the other beer (Paypal) to the person helping me to be able to access the data again.

---

Here are some outputs:

/dev/sda startinng sector 2048 end sector 2930272255 (1 sector = 512 bytes)

Size I shrinked the NTFS fs to: 656511M

Size I changed the NTFS partition to: a little less than total sectors / 2 => 1400000000 sectors

fdisk before partitioning:

Disk /dev/sda: 1500.3 GB, 1500299395072 bytes
255 heads, 63 sectors/track, 182401 cylinders, total 2930272256 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000303ee

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1            2048  2930272255  1465135104    7  HPFS/NTFS/exFAT

Partition table after fdisk:

Disk /dev/sda: 1500.3 GB, 1500299395072 bytes
248 heads, 15 sectors/track, 787707 cylinders, total 2930272256 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000303ee

   Device Boot      Start         End      Blocks   Id  System
/dev/sda2            2048  1400000000   699998976+   7  HPFS/NTFS/exFAT

fdisk verify:

Command (m for help): v
Remaining 1530274302 unallocated 512-byte sectors

ntfsfix /dev/sda2:

root@rasp:~# ntfsfix /dev/sda2
Mounting volume... Failed to load runlist for $MFT/$DATA.
highest_vcn = 0x68f, last_vcn - 1 = 0xe24f
Failed to load $MFT: Input/output error
FAILED
Attempting to correct errors... Failed to load runlist for $MFT/$DATA.
highest_vcn = 0x68f, last_vcn - 1 = 0xe24f
Failed to load $MFT: Input/output error
FAILED
Failed to startup volume: Input/output error
Checking for self-located MFT segment... OK
Failed to load runlist for $MFT/$DATA.
highest_vcn = 0x68f, last_vcn - 1 = 0xe24f
Failed to load $MFT: Input/output error
Volume is corrupt. You should run chkdsk.

1. Update:

ntfsfix /dev/sda:

root@rasp:~# ntfsfix /dev/sda
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
The alternate bootsector is usable
Set sector count to 2930272255 instead of 2930270207
Rewriting the bootsector
The boot sector has been rewritten
ntfs_mst_post_read_fixup_warn: magic: 0xffffffff  size: 1024   usa_ofs: 65535  usa_count:     65534: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
Volume is corrupt. You should run chkdsk.

fdisk /dev/sda2 right now:

Disk /dev/sda2: 716.8 GB, 716798951936 bytes
255 heads, 63 sectors/track, 87145 cylinders, total 1399997953 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x444c544e

This doesn't look like a partition table
Probably you selected the wrong device.

     Device Boot      Start         End      Blocks   Id  System
/dev/sda2p1   ?  1768778098  1776409558     3815730+  6b  Unknown
/dev/sda2p2   ?  1830843506  3225479386   697317940+  75  PC/IX
/dev/sda2p3   ?  1718906437  1718909009        1286+  41  PPC PReP Boot
/dev/sda2p4      2827157504  2827210421       26459    0  Empty

Partition table entries are not in disk order

fdisk /dev/sda right now:

Disk /dev/sda: 1500.3 GB, 1500299395072 bytes
255 heads, 63 sectors/track, 182401 cylinders, total 2930272256 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x444c544e

This doesn't look like a partition table
Probably you selected the wrong device.

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   ?  1768778098  1776409558     3815730+  6b  Unknown
/dev/sda2   ?  1830843506  3225479386   697317940+  75  PC/IX
/dev/sda3   ?  1718906437  1718909009        1286+  41  PPC PReP Boot
/dev/sda4      2827157504  2827210421       26459    0  Empty

Partition table entries are not in disk order

---

The above output is strange. I ran testdisk - repair boot sector yesterday and it seems to have killed the partition table. Also the disk identifier changed?

What I do right now: run testdisk [REPAIR BS] again because it did not lead to success yesterday (taking about 6 hours)

All Linux-based NTFS repair utilities are unfortunately rather limited in their scope and ability. Testdisk is the best you're going to get on the cross-platform side of things, and while it is awesome for recovering partitions and bootsectors it's really not what you're going to need if you damaged the NTFS filesystem itself. The best testdisk will do in that case is attempt to restore the MFT mirror. ntfsfsck/ntfsfix are severely neutered and have had parts of their recovery features/methods turned off from years ago due to being dangerous because of being incorrectly implemented or not fully understood when reverse-engineered.

If you have access to a Windows setup CD for Vista and above, use the command line feature from the "Startup Repair" to try chkntfs /f on the partition in question (if it can be seen). Failing that, it may be time to pull out your favorite file recovery tool for the retrieval of files from formatted volumes.

Free software: Testdisk's counterpart, photorec, does just that. I personally have had good experiences with Recuva from Piriform, but that's a Windows-only program so you'll need your hard disk connected to another Windows machine.

There are hard-core commercial NTFS file undelete applications, but honestly, they're almost never worth the hassle - if your partition is damaged enough to need them, you'll get your files back, but they probably will be incomplete/corrupted and won't actually open. Your best bet would be to use those tools to retrieve certain files by name.

Be forewarned: software that recovers files from deleted partitions can take up to several days to run a deep scan!